Hacker News Reader

Comment by jay_kyburz | Hacker News Reader

I would be interested to know how many of the 450 apps actually needed your location data to do their job. If the app is an exercise app with a map, its a feature that it knows where I am.

If it's a messenger app with a feature that can share your location, then its expected that it will have access to the API's.

View on HN

If you got a JBL speaker, you cannot upgrade its firmware without the app. The app requires location access, otherwise it will not work at all. There is no reason for location access because even if you grant access, it doesn't feature anything like a map or compass. It solely uses the location for marketing.

Also, you cannot just search for a new firmware update and uninstall the app immediately afterwards. You have to wait a few days for it to notify you so they can track you for a longer period of time.

That's a violation of the Apple app store terms of service, but I have never yet successfully reported such a violation to Apple. Their tech support doesn't understand what to do with such reports and after many back-and-forth attempts I've just given up trying for now.

Apple employees, if you're reading this, it's an obvious violation of ASRG 5.1.1 (iv) Access and it's probably a violation of ASRG 3.1.4 Hardware Specific Content — but as a mere developer, there's nowhere for me to report that for internal investigation. Perhaps one of you can do better.

They have different rules for big companies and for small companies. All big companies are given a pass on shady stuff

Apple employees, if you're reading this, I would _LOVE_ a way to flag an app notification as spam. I use a few apps that I really need notifications on for (delivery apps, and the like) but that insist on spamming me. Pretty sure this is a ToS violation, but I'm entirely unsure how to do anything about this.

> That's a violation of the Apple app store terms of service

Like it is of hundreds of other high profile apps... other than facebook.

On iOS the "JBL Portable" app(a recent new name for their app JBL Connect) does not require any access to location.

Are you talking about the Android app?

bluetooth and location permissions are many times together, because if you can scan the device macs you are able to use it to locate the user ( with bluetooth beacons for example).

What is it in speaker firmware that needs upgrading anyway?

I never even connected my Nintendo Switch to the internet.

(It's pretty cool actually that when you buy a physical game, if they need an OS update it's shipped on the cartridge. )

My experience with Bluetooth connectivity is lots of things don’t work universally when shipped.

It very likely asks the location permission because it wants to scan Bluetooth devices. Scanning Bluetooth devices can be useful to detect the speaker, but it's also often used to track user locations especially indoor where the GPS doesn't work or is not precise enough.

You can place Bluetooth emitter beacons around an area and by scanning the Bluetooth devices on the smartphone and some triangulation, you know precisely where the smartphone is.

By the way even Apple, which is not that privacy friendly, sells such Bluetooth beacons to track peoples' location. https://en.m.wikipedia.org/wiki/IBeacon

This technology can have good use too, in retirement homes or hospitals for example. But it's mostly used to know where you are in a mall.

On android 9+, giving it the permission is not enough.

You must also enable the GPS and wait for it to lock your position :( :( :(

So yeah, it's a function designed to force you give away your location (masquerading as a privacy feature)

Which is the reason I prefer websites to apps. Ok, there are certain tasks that are not feasible without an app. Mostly though, what's done in the app could be done on a website. And the website is by far more accessible through a wide variety of devices with a range of operating systems.

Websites can track you as well and the UI’s are horrible for the most part. Of course, many apps are basically websites in an app browser. Sigh.

I use a Bose QC35 and its app too requires location enabled to be open.

Unfortunately, both Google and Apple decided to merge Bluetooth and Location permissions a while back, on the basis that bluetooth scans can be used to unmask your location (by fingerprinting known BLE beacons). This means that any app that needs to communicate over BLE is forced to request the location permission - even if they don't want to.

That's not to say anything about whether this app in particular is using location maliciously, of course. But all apps for BLE devices are in this boat :/

There should be finer grained location permissions like "this app requires access to your location when you're writing a message" (messenger). I think apps can currently check your location whenever they're open and potentially when they're not unless you restrict background processes.

Not sure how that could be implemented without creating a domain specific set of actions like defined Intents in android or Siri intents on iOS. In this case, apps would be required to use a messaging intent that provides location information once a message is initiated by a user. But how to be sure user initiated the message?

https://github.com/expressvpn/xoth_location_tracker_investig...

At least one of the apps listed (Telegram) uses location when you choose to like sharing your location with people and I have never seen it request location otherwise. Puts the rest of the data in to question for me.

From TFA (emphasis mine)

> These include apps masquerading as popular services such as Telegram, Facebook Messenger, and WeChat.

Note they are masquerading as the listed messengers, not the actual messengers themselves

Reply on news.ycombinator.com